5

I've made the deposit into my investment account, but company ask me for the scans (front and signed back) of my Credit Card that I used to make the deposit and send them via e-mail for verification purposes.

Is that even legal to ask for that? Can they do that?

Obviously somebody can hijack my e-mail (sys-admin, hacker, NSA) and steal me credit card details.

The e-mail and company is legitimate and it is per their standard policy, that the card scans are required for the allocation of the deposit:

For security reasons and to protect against fraud, clients are required to submit a scanned copy (front & back) of their credit/debit cards and a recent account statement for each conducted transaction. Backside of the card must be signed and the signature clearly visible.

Improve this question
8
  • 8
    How can emailing unencrypted credit card information be PCI compliant? As soon as your company stores credit card data in-house, the requirements to remain PCI compliant increase drastically.
    – self.name
    Feb 5, 2015 at 17:51
  • 1
    I don't know about the UK, but in the US the legal liability for theft of CC info like this is $0 as long as you report it within a couple months.
    – blahdiblah
    Feb 5, 2015 at 18:46
  • A photo of the credit card would include the CVV number, and generally merchants are not supposed to store that. It's maybe a little muddier here because they're not using it specifically to authenticate a credit card transaction but for some other verification purpose, and they may or may not actually store it indefinitely, but it does make it look questionable. This wouldn't make their request illegal, but it might violate their agreement with their credit card processor...
    – Nate Eldredge
    Feb 5, 2015 at 23:25
  • 2
    You might contact your credit card company and ask for advice. Generally you're not liable if your card information is misused, but if you make it possible by doing something really egregious, the card company could claim you were negligent and try to make you liable anyway. Something like "emailing photos of your card" might come close to that standard.
    – Nate Eldredge
    Feb 5, 2015 at 23:26
  • 1
    aaafx looks a very dodgy site if you must do FX dealing go with one of the big well established players based in the UK
    – Pepone
    Feb 14, 2015 at 16:52

3 Answers 3

Reset to default
16

Why do you care if it's "legal"? If you are concerned about the security implications and don't want to do it, then don't do it. If the company won't accept your deposits without it, then go to another investment company. There are hundreds of them out there. I have never, ever had someone ask for a scanned image of my credit card, and I've done business with at least half a dozen investment companies, so this is not a standard industry practice. You have at your disposal a protection far stronger than the ability to bring some sort of legal complaint: You can take your business elsewhere. Doing that doesn't require hiring a lawyer or going to court or anything. You just do it.

All that said, there are ways to avoid creating much additional security risk. I presume you've already given them your name, address, card number, and security code over the phone or through their website, so you've trusted them with this information, and if hackers or the NSA wanted to snoop on your private information, they could have done it then. Okay, a web page might have used https and thus been encrypted while an email is not. So three solutions: (a) If they provide an upload on an https page, use that and you have no more security risk than when you originally entered this information. (b) Put the scanned image into an encrypted file before emailing, like say an encrypted PDF, or encrypt the image file with some other software, and then send them the password in a separate email. (c) You can get fairly decent security by sending the front and back of the card in two separate emails sent at different times. Then a hacker would have to intercept both and be able to connect them to each other.

BTW I wouldn't really worry about the NSA intercepting such emails. I presume that if they want access to your credit card account, they have easier ways to accomplish that than figuring out this unusual system. Unless they have some specific reason to target you or this investment company, they're probably not searching for images of credit cards in emails.

Improve this answer
9
  • 3
    Sending of separate emails is not going to help against the large majority of man in the middle attacks. All I can say that security technically speaking only (a) here is a valid option.
    – David Mulder
    Feb 5, 2015 at 23:15
  • 1
    @Jay First of all, realizing that two different emails from the same address belong together isn't really all that hard. I mean, the kind of attack we would be talking about here would be a (semi) targeted attack either way, as an automated attack would never pick up on something like a scan of a creditcard. Next a (non-government) man-in-the-middle attack would realistically only happen on the client or company-side, in which cases both emails would at all times be intercepted at those points. But yeah, that last sentence explains it all I guess :P :P governments...
    – David Mulder
    Feb 6, 2015 at 15:31
  • 1
    @Jay You are so overestimating the efficiency. First of all I have never heard of automated man-in-the-middle attacks that intercept mail and search for scanned credit cards, so we're talking about targeted attacks either way. Now, if I go out on a tangent I definitely can imagine situations where it works: The attacker is using a fake or insecure wifi hotspot to intercept data and you use this wifi hotspot for one part, but not the other. Still, if you would have just send both from home you would've been save in the first place. (cont.)
    – David Mulder
    Feb 6, 2015 at 19:29
  • 1
    Next I am disregarding options where somebody is intercepting mail at your internet provider or something (because that's virtually never happened as far as I know) so we're talking about either a virus on your system or a man-in-the-middle attack on the side of the receiving party (either a simple virus or a more complex corporate attack where network data is intercepted). If the hacker takes a look at any of the two mails it will be abundantly clear that the other half is located in another email (because you will need to explain (cont.)
    – David Mulder
    Feb 6, 2015 at 19:29
  • 1
    the concept to the receiver at some point) and then it's a simple case of matching both the sending and receiving party. I mean, it's just totally crappy security advice... I mean, mail is as insecure as anything ever created and this simply isn't going to help. Even if you send the other mail from your mobile data connection that only eliminates 50% of the attacks. Either way, if you wish to know more ask a question on security.SE and I am sure that somebody will be willing to explain this to you in a better way than I am doing now :)
    – David Mulder
    Feb 6, 2015 at 19:30
4

What two pieces of information would they get: the signature and the security code on the back. The account number, expiration date, and your name are on the front.

I would be very suspicious of that request. The info they need to process the transaction was collected at the time of the transaction. The picture of the card prove that you are in possession of a picture of the card.

Contact your credit card company. Also check to see if the transaction went through. I have never had somebody ask for a scan of the card.

Don't trust the email address they gave you. It may look legitimate, but you would need to check. Also the https security doesn't mean that a email is secure, in fact email isn't secure unless encryption on the message is used. I don't trust this request.

EDIT: In your edit to the question you included a link to their policy page

you didn't finish the quote:

For security reasons and to protect against fraud, clients are required to submit a scanned copy (front & back) of their credit/debit cards and a recent account statement for each conducted transaction. Backside of the card must be signed and the signature clearly visible. All important data (full name, card number, residential address) should be clearly visible. These documents are destroyed immediately after successful transaction completion and can be uploaded either via your account “Profile” page or by email submission to [email protected]. AAAFx may personally contact you by telephone to verify certain transactions.

The key is that they can by uploaded via your profile page. Assuming it has an https url that is the way to go.

Improve this answer
2
  • Thanks. The e-mail and company is legitimate, but they don't want to proceed the deposit without the card scans as it is their standard policy: 'For security reasons and to protect against fraud, clients are required to submit a scanned copy (front & back) of their credit/debit cards'. Updated question with additional info.
    – kenorb
    Feb 5, 2015 at 13:49
  • why would you need to do that in the UK I have opened a trading account (TD Direct) with utility bills and a scan of my birth certificate.
    – Pepone
    Feb 14, 2015 at 16:54
0

I've asked the same question at NatWest Bank Online Community, and I've got the following response from the Community Manager:

We'd like you to be as protected as possible, so due to the risk of your card details being seen by others than those intended, we wouldn’t recommend sharing your details like that.

It might be best to contact them and say you're not comfortable sending that kind of information and see if there's anything they can do to help you.

Hope that helps.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .